ci: auto-publish Windows zip to Gitea Releases

After a successful windows-cross build on main or v* tags, upload the zip
and .sha256 via scripts/release_windows.sh (creates/updates v$VERSION).
Prefer secrets.RELEASE_TOKEN; fall back to GITHUB_TOKEN. Skip on PRs.

.gitea/workflows/ci.yml

@@ -2,6 +2,8 @@ name: ci
 
 on:
   push:
+    branches: [main]
+    tags: ['v*']
   pull_request:
 
 concurrency:
@@ -112,3 +114,22 @@ jobs:
           ls -lah dist/cst-agent-*-windows-x86_64.zip
           cat dist/cst-agent-*-windows-x86_64.zip.sha256
           unzip -l dist/cst-agent-*-windows-x86_64.zip | head -20
+      # Auto-publish to Gitea Releases (v$CST_VERSION from include/cst_version.h).
+      # Prefer repo secret RELEASE_TOKEN (write:repository); fall back to the
+      # job token. Skipped on pull_request and when no token is available.
+      - name: Publish Gitea Release
+        if: github.event_name == 'push'
+        env:
+          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CST_GITEA: ${{ github.server_url }}
+          CST_REPO: ${{ github.repository }}
+          GITHUB_REF: ${{ github.ref }}
+          CI: "true"
+        run: |
+          export GITEA_TOKEN="${RELEASE_TOKEN:-${GITHUB_TOKEN:-}}"
+          if [[ -z "${GITEA_TOKEN}" ]]; then
+            echo "::warning::no RELEASE_TOKEN / GITHUB_TOKEN; skip auto-release"
+            exit 0
+          fi
+          bash scripts/release_windows.sh

README.md

@@ -156,7 +156,9 @@ make && make install      # 装到 Termux 的 $PREFIX/bin，之后任意目录
 ```
 
 产物：`dist/windows-x86_64/`（静态链接的 `cst-agent.exe` + `busybox.exe`，无其他 DLL）和
-`dist/cst-agent-VERSION-windows-x86_64.zip`；`GITEA_TOKEN=... scripts/release_windows.sh` 上传到 Release。
+`dist/cst-agent-VERSION-windows-x86_64.zip`。CI 在 `main` / `v*` tag 推送且交叉构建成功后会自动上传到
+Gitea Release `vVERSION`（同名资源会被替换）；仓库可设 `RELEASE_TOKEN`（`write:repository`），否则用任务自带 token。
+本地：`GITEA_TOKEN=... scripts/release_windows.sh`。
 
 环境变量：`CST_SHELL`、`CST_EXE_DIR`、`CST_AUTO_APPROVE` 等。
 

docs/README-windows.md

@@ -160,12 +160,19 @@ scripts/bootstrap_msys2.sh
 
 ### 发布
 
+CI：推 `main` 或 `v*` tag 且 `windows-cross` 成功后，自动把 zip / `.sha256` 发到
+Gitea Release `vVERSION`（版本来自 `include/cst_version.h`；同名资源替换）。仓库 Secrets
+可设 `RELEASE_TOKEN`（`write:repository`），没有则用 Actions 自带 token。
+
+本地：
+
 ```bash
 GITEA_TOKEN=... scripts/release_windows.sh --build
 ```
 
 创建（或复用）`vVERSION` Release，上传 zip 和 `.sha256`。token 只从环境变量读取，经 stdin
-交给 curl，不会出现在命令行参数、磁盘或输出里。
+交给 curl，不会出现在命令行参数、磁盘或输出里。发版前先 bump `cst_version.h`；推
+`vX.Y.Z` tag 时必须与头文件一致。
 
 ## 已知限制
 

scripts/release_windows.sh

@@ -5,13 +5,17 @@
 # --build runs scripts/bootstrap_windows.sh first. The token is only read from
 # the environment and handed to curl on stdin: it never appears in argv, on
 # disk or in the output. Assets of the same name are replaced.
+#
+# CI: set GITEA_TOKEN (or GITHUB_TOKEN), CST_GITEA, CST_REPO. The remote-branch
+# check is skipped under GITEA_ACTIONS / GITHUB_ACTIONS / CI.
 set -euo pipefail
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-SERVER="${CST_GITEA:-https://git.whcself.xyz}"
-REPO="${CST_REPO:-WHC/CST-agent}"
+SERVER="${CST_GITEA:-${GITHUB_SERVER_URL:-https://git.whcself.xyz}}"
+REPO="${CST_REPO:-${GITHUB_REPOSITORY:-WHC/CST-agent}}"
 API="$SERVER/api/v1/repos/$REPO"
 
-[[ -n "${GITEA_TOKEN:-}" ]] || {
+TOKEN="${GITEA_TOKEN:-${GITHUB_TOKEN:-}}"
+[[ -n "$TOKEN" ]] || {
   echo "set GITEA_TOKEN (a Gitea token with write:repository)" >&2
   exit 1
 }
@@ -26,10 +30,19 @@ for f in "$zip" "$zip.sha256"; do
   [[ -f "$f" ]] || { echo "missing $f (scripts/package_windows.sh, or --build)" >&2; exit 1; }
 done
 
+# If this job was triggered by a version tag, it must match cst_version.h.
+if [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
+  ref_tag="${GITHUB_REF#refs/tags/}"
+  if [[ "$ref_tag" != "$tag" ]]; then
+    echo "pushed tag $ref_tag != cst_version.h $tag; bump include/cst_version.h" >&2
+    exit 1
+  fi
+fi
+
 api() { # METHOD PATH [curl args...]
   local m="$1" p="$2"
   shift 2
-  printf 'Authorization: token %s\n' "$GITEA_TOKEN" |
+  printf 'Authorization: token %s\n' "$TOKEN" |
     curl -fsS -X "$m" -H @- "$API$p" "$@"
 }
 json() { # CODE [ARGS...]: d = the JSON on stdin, ARGS in sys.argv[1:]
@@ -42,12 +55,14 @@ if rel="$(api GET "/releases/tags/$tag" 2>/dev/null)"; then
   echo "==> release $tag exists"
 else
   head="$(git rev-parse HEAD)"
-  if ! git branch -r --contains "$head" 2>/dev/null | grep -q .; then
-    echo "HEAD $head is not on any remote branch; push it first" >&2
-    exit 1
+  if [[ -z "${CI:-}${GITEA_ACTIONS:-}${GITHUB_ACTIONS:-}" ]]; then
+    if ! git branch -r --contains "$head" 2>/dev/null | grep -q .; then
+      echo "HEAD $head is not on any remote branch; push it first" >&2
+      exit 1
+    fi
   fi
   echo "==> creating release $tag at $head"
-  body="$(python3 -c 'import json,sys; print(json.dumps({"tag_name": sys.argv[1], "target_commitish": sys.argv[2], "name": "CST-Agent " + sys.argv[1], "body": "Windows x86_64: unzip, or install with scripts/install_windows.ps1"}))' "$tag" "$head")"
+  body="$(python3 -c 'import json,sys; print(json.dumps({"tag_name": sys.argv[1], "target_commitish": sys.argv[2], "name": "CST-Agent " + sys.argv[1], "body": "Windows x86_64: unzip, or install with install_windows.ps1 from the zip.\\n\\nArtifacts: `cst-agent-VERSION-windows-x86_64.zip` + `.sha256`."}))' "$tag" "$head")"
   rel="$(api POST /releases -H 'Content-Type: application/json' -d "$body")"
 fi
 id="$(json 'print(d["id"])' <<<"$rel")"